HINSTANCE hDll2=NULL;

class CHookVirtualQuery
{
public:
	CHookVirtualQuery(){};
	~CHookVirtualQuery(){};
public:
	BOOL HookOn(HINSTANCE hDll, DWORD dwSize);
	BOOL HookOff();
	BOOL IsHookEd();
private:
	DWORD GetVirtualQuery();
	HINSTANCE hDllModule;

};
DWORD g_dwMageSize;

void DispatchVirtualQuery(DWORD dwModuleAddress,DWORD dwQueryStruct)
{
	char msg[128]={0};
	PMEMORY_BASIC_INFORMATION pState=(PMEMORY_BASIC_INFORMATION)dwQueryStruct;
	if(hDll2==(HINSTANCE)(dwModuleAddress))
	{
		//MessageBoxA(0,"","",0);
		pState->BaseAddress = 0;
		pState->AllocationBase = 0;
		pState->AllocationProtect=0;//PAGE_READWRITE
		pState->State=MEM_FREE;//MEM_RESERVE
		pState->Protect=0;
		pState->Type=0;//MEM_PRIVATE
		pState->RegionSize = g_dwMageSize;
	}
	return;
}

__declspec(naked) void HookVirtualQueryFun()
{
	__asm
	{
		pushad;
		push [esp+0x28];
		push [esp+0x28];
		call DispatchVirtualQuery;
		add esp,8;
		popad;
		retn 0xc;
	}
}


BOOL CHookVirtualQuery::HookOn(HINSTANCE hDll, DWORD dwSize)
{
	DWORD dwHookAddr=0x1384FE0;
	hDllModule=hDll;
	g_dwMageSize = dwSize;
	hDll2=hDll;
	if(IsHookEd())
	{
		return TRUE;
	}
	else
	{		
		DWORD* pBegin=(DWORD*)(void*)(GetVirtualQuery()+0x16);
		__asm  
		{
			push eax;
			push edx;
			lea eax,HookVirtualQueryFun;
			mov edx,dwHookAddr;
			mov [edx],eax;
			pop edx;
			pop eax;
		}
		BYTE paddingCode[]={0xFF,0x25,0xF4,0xBF,0xEB,0x00};
		*(DWORD*)(paddingCode+2)=dwHookAddr;
		WriteProcessMemory(INVALID_HANDLE_VALUE, (void *)pBegin,(void *)paddingCode,6,NULL); 
	}
}

BOOL CHookVirtualQuery::HookOff()
{
	BYTE dwoDate[]={0xC2,0x0C,0x00,0x90,0x90,0x90};
	WriteProcessMemory(INVALID_HANDLE_VALUE,(LPVOID)(GetVirtualQuery()+0x16),&dwoDate,6,NULL);
	return TRUE;
}

BOOL CHookVirtualQuery::IsHookEd()
{
	DWORD dwoDate=0;
	if(GetVirtualQuery()!=0) 
	{
		ReadProcessMemory(INVALID_HANDLE_VALUE,(LPVOID)(GetVirtualQuery()+0x16),&dwoDate,4,NULL);
	}
	if(dwoDate==0x90000CC2)
	{
		return FALSE;
	}
	return TRUE;
}

DWORD CHookVirtualQuery::GetVirtualQuery()
{
	HINSTANCE hVirtualQuery=LoadLibraryA("KERNEL32.DLL");
	DWORD lpvoid=0;
	if(hVirtualQuery) lpvoid=DWORD(GetProcAddress(hVirtualQuery,"VirtualQuery"));
	//if(lpvoid!=NULL) 
	//{
	//	char msg[256]={0};
	//	sprintf(msg,"%x",lpvoid);
	//	MessageBox(NULL,msg,"msg",MB_OK);
	//}
	FreeLibrary(hVirtualQuery);
	return (DWORD)lpvoid;
}